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From ; UK05744SUKPR , UKY . EDU 

Subject: tap news 

Date: Sun, 06 Jan 91 23:45:04 EST 

In a recent issue of CuD, the moderators wrote: 

>TAP is alive and well. In addition to a newsletter, they also have a BBS for 
>exchange of information and news. TAP is available for the price of a 
>postage stamp for each issue by writing: 
> 

> TAP 

> PO Box 20264 

> Louisville, KY 40250 

Greetings ! 

I wanted to help clear up any misconceptions some people might have regarding 
TAP Magazine. The first point is that I am no longer editor. After Craig 
Neidorf got molested, I decided do let go of TAP and concentrate on more 
important things. Therefore, I handed editorship to Predator. Since then, I 
have had NOTHING to do with TAP Magazine. The second point is the details of 
the subscription. I am not totally sure of this but it is what I hear. TAP 
is not free anymore (I don't know why. I put it out for free), it is now $2 
for a SAMPLE issue. The yearly rates are $10 for ten issues. If anyone has 
any questions regarding TAP, don't mail me. Mail them to Predator at the 
above address. 

If anyone wants to correspond with ME, you can mail me at 
UK05744@UKPR.UKY.EDU. OR UK05744SUKPR.BJTNET, 



THE DNA BOX 

Hacking Cellular Phones 

by 

The Outlaw Telecommandos 



TAP RAP / issue 103 by Predator 

Well here it is, another issue. I have a bunch of random stuff to throw 
your way so listen up. Thanks go to Reficul for the cover art Who savs 
hackers can't do anything besides mess with computers? Reftcui also did 
u^h C ?X e ? X ^ e 9 Z'. Thanks 9° to Sinister X for the colored paper 
used in issue 101 and in 103. The Postal monopoly raised their prices 
Thats t'luTrll^l J? 11 Paced . Se ™oe. Twenty^ine cents for a st^ 
Thev \L^« h*L " £ ou r Pe™ies. What kind of stupid price is that? 
thtrtv^t, L 3USt got another penny out of us and made it an even 
naifnn *h?« , : „ 6 1S,Dy $ ^ 16 give me 4 stamDS P^ase. What are we 
Kft h ? t lnc *ease in price for, even slower service, more lost mail, 
hell if i know but is has to suck. «"**x, 

lalJ 1 ^ n^ dealt » U ?!! With the °Pe«tion Sundevil busts or the Phrack 
case in Chicago. We thought since it was plastered everyplace else we 
would not force it down your throat too. How many times can you read the 

r^r«°2[ ? e n° re Xt beC ° neS b ° ring? Wel1 i would like to inform our 
Hit f * w- 9 ? eidorf tne forroer ^itor of PHRACK still needs some 
V?i^ in . P a y in 9 his lawyer fees. Since he was molested by Bellsouth and 
faced false charges for publishing a newsletter most all of us have read 
iJ?^ We ° We hl,D a little f ° r his te rrible ordeal. Show your support 
a £f k G ? ou t someone who fought the system and won, but doesn't have 
the bank roll to back him like Bellsouth those corporate bastards. 

Neidorf Defense Fund 
Katten, Muchin and Zavis 
525 West Monroe St #1600 
Chicago, IL 60606-3693 
Attn: Sheldon Zenner 

frorLn^h^ d S a K- ng W ^? in mySelf t0 Step U P tne tiroe of Publication 
*»°T™ 2h y t0 bl - ffi ° ntnl y- I ^n't know till i see how things shape up 
during the next couple of months. I can print 20-24 issues a year if i 

w^i J°hni- a ^ leS in here - 1 have lots of De °P le sa y in 9 V eah i will 
2£- i K k 1 . ne Y e f see an y th ^9- I will also be changing TAP around 
some in its physical layout. As soon as i find a good desk top 
publishing program i will switch over to it for most of the issues 
S™ t V X W ii- Sta f t a c l assi fieds page or two in the next issue. If 
you want something placed in there send it in to me very soon. I might 
charge for future issues but for now, if you subscribe it's free. 

^i?: Shi f tS m i 9h w SOOn ** a re *lity. All i need is a cheap, but good 
quality place to have them done. If you know of one forward it to me A 
SS ££ £h?f ^ iSSUGS will.be ready by spring time. Stay tuned 
!^?J details. If your subscription runs out you will not get a fancy 
reminder in the mail. Just look on the top of your mailing label and it 
will show you the last issue which you will get. Example if it says 103 

?ii w 1S your last issue - Re new as soon as possible or you 
will be removed from the mailing list. 

Here is a short list of needed items to keep TAP going strong in 91 
Articles, hack - phreak - anarchy text files ibm format, new 29 cent 
stamps, 4 cent make up stamps used with the old 25 cent stamps. IBM bbs 
or terminal programs for our bbs users. 360k or 720k disks. Copy paper 
any color is also needed. F/ Fa F exr 



PART TWO 

The previous DNA file discussed the possibility of using Japanese handheld 
HAM radios and personal computers, or tape recorders to hack Cellular Phone 
codes, and possible uses for investment & business info obtained by 
hacking executive and corporate phone calls, and investment info services. 

Here I want to mention the obvious idea of simply modifying or replacing the 
ROMs in a standard Cellular Phone, and disassembling the ROM software that 
operates the Phone in order to "customize" it for scanning, data monitoring, 
evesdropping and (of course) making free calls using the codes of registered 
subscribers. 

Simply unplugging the ROMS, putting them on a ROM card for a PC and then 
copying the software to disk for disassembly is the obvious first step. 
Use of a logic analyzer to monitor and record activity on the Cellular Phone's 
digital bus would simplify things by providing a map of where data is stored 
and which instructions are executed during each period of activity: 
decoding/sending ID tones, selecting frequencies, dialing, and talking. 

Checking the part number on the CPU embedded in the Cellular Phone will tell 
you which disassembler to use to give a rirst draft of the ROM code. 
The next step is to generate a map of the locations of every subroutine 
call's entry point, any branch & loop locations, and all addresses written to, 
read, or read-only (to map out any variables and data). Locations incremented, 
decremented or tested by branch instructions should also be noted, along with 
their initial and final values. 

Each address in the map should be given a symbolic label in your draft of 
the assembly code. Comments can also be entered with high-level language 
equivalents that summarize the assembly code as you understand it. 
Pay special attention to data or loop limits that match elements of the 
Cellular Phone ID codes (length or contents), or any data locations that 
are always accessed as a group. This may give you enough info to find the 
location of the ID code and burn an EPROM with any ID's you've hacked 
by listening to Cellular Calls. 

If you have identified the subroutines that accept phone numbers for dialing, 
you can patch in a second subroutine that accepts an ID code from the keypad 
and stores it in RAM before calling out, and modify any routines that 
utilize ID Codes to use RAM addresses instead of ROM addresses. 

Chances are that the software takes up most or all of the available ROM 
and RAM scratchpad space on the single-chip microprocessor. If this is the case 
it might be neccessary to piggyback additional memory chips onto the circuit 
board to hold any new subroutines you want to add. 

Suggested new features: 

1) Have the Cellular Phone scan for an empty channel and wait for an ID code. 
Capture the ID code into a table of ID'S in RAM and display the captured codes 
on the liquid crystal display. 

2) Program the Cellular Phone to emulate the switching signals and codes sent 
by PacBell (or your local Cellular carrier), bypassing central switching 
entirely. This would be useful for making 100% untraceable calls to other 



Cellular subscribers within direct radio range. This can be used to do your own 
routing, emulating a phantom switching cell. This could be used to extend 
cellular service into an otherwise inaccessible area by coupling your Cellular 
Phone to a 1.2GHz linear amplifier modified to work in the 800MHz band. 

3) Make the Cellular Phone recieve data under one ID/Frequency and retransmit 
it under another. This would make it impossible to monitor both sides of a 
conversation. This feature could also be used to implement conference calling 
by running several calls at once out of one phone. 



THE PERFECT WIlSON! 
by Ctnulhu 

It was a cold snowy night. My partner, who's identity sh *" ["* m **" 

.Known, ana I were coin* door to door. When tried »* ch r ^ *£%£' Vy 
aia<=s pained doors proved to be locked. The campus was closed for 
winter break. The all the surrounded parking lots were empty. Its 
was tne first time we were able to park, so close. 

We triea half of the external doors around the ^ 11 ^ t » nt ^ £ re 
reacned the loading docks to the sub-levels or University. We were 
ready to give ud when a half hearted yank on a door let me to find 
"unlocked. It was great I A gentle rush hit us both. .hi. n»s truly 
Cnristmas! 

*e roameo the halls of the school. Meet of the hallways "•;"•"*• 
but "took the lone, way to the Applied Computer Science orfices 
Sn^::. !°0n the oiAce doors «ere taped our keys: the orade reports. 

-ace, with the corresponding students social purity 
number. With a satisfactory amount of them, which was •" °J *^\n 
in nand. we Doth felt very snug. That feeling grew wnen we walked in 
io tne unlocked room ladled 'HAD VAX' on the other side of the 
scnool. Once in the room, we both took off our jackets and got 
comfortable sittmc before the familiar IBM brand ascn terminals. 
Fiippea on our terminals and went to work. 



Our plan was to use the loam name ' newu 
password our cooieo social security numb 
sneets. This plan was established on the 
system users recieve notices that they h 
system. This notice tells them to enter 
ana then to enter their social security 
we listed the passworo file we could se 
account by the nopass' entry instead of 
the password field. Yet the hardest part 
security numbers that corresponded with 



ser' and enter in as a 
er from the grade report 

knowledge that all the 
ave an account on the 
'newuser' as a login name 
number as a password. When 
who had not activated their 
an encrypted password in 
was obtaining the social 
the target accounts. 



To obtain the numbers we tried hopping over false ceilings to get 
Into ocked rooms where such lists might be found. We tried getting 
tne numbers from student librarians and student campus securi ty 
personel. None of the ideas panned out. The the idea of the gr «de 
Sports came by accident, -st seeing the P^P- on^the -all. 

^^il^tn^mpIeL: ^p-«"U -i«ht not have gotten on the 



CIA Promises: 
This Time No Dirty Tricks 



system to activate their account, 
password keys to UNIX locks. 



So the grade reports were the 



w'hen we jsed most of the social security numoer passwords up, our 
feelings of granoure began to fade. As the list diminished we felt 
that it was a waste. But tnen finally it happened. One of tne 
accounts opened. The system allowed us to become a newuser. We 
enterec a new passwora, as directed by the computer « and then viewed 
tne account's files. It was Dare except all the derault UNIX 
configuration files. It worked 1 It fucking plan worked' 

I worked on the new account, first real time I have ever teen on 
UNIX, or any mainframe ior that matter, I proded around with 
commands I knew from UK 1 IX manuals tnen I went back to trying the 
'newuser logins. But, sadly, that was the only one that did work, 
out of the listing we scribbled down. 

So now knowing tne plan worked we thought of whom else has access to 
the system? Math ma.icrs did, my partner thought. It sounded good to 
me. So we proceeded to copy seemingly related mathematics grade 
results down. UnTor tuna t I y , many of the prime target grade reports 
on 1 ,■ gave a partial social security number. But if only one number 
more came through it would be worth it. So we ended up copying 
reports that weren't quite the type a computer science student would 
be taring. Since other people would be in those classes we felt the 
ooos were against us more. But we headed back to the the VAX 
terminal cluster named 'MAD vA*. ' . 

In the hallway* we were standing on a glass bridge over looking the 
road arouna the inner campus, when we got half way over a. trio of 
cars passed undernea.tr us. Fanic hit us. One was a police car. Now 
the the rush we felt before was nothing like the one we felt now' 
Butterfiys in the stomach, the random bursts of the words 'fuck' ana 
shit', as weli as the rest of tne symptoms to fear. 

Our reactions were instict. Take of f ! We headed to the lower levels 
of the building. We stopped on the ground level right oefore an e.;it 
leading out, to the far side of the campus from my partners car, ana 
a door that lead through one of the basement levels of the school. 
My partner looked out the door and 1 checked the basement coor. Tne 
basement was not lit and it was a straight line through for most of 
way to the otherside, where the car was. 

1 began to approach the door ano then there he was. The man I can 
now identify as a 'pig , but at the time I identified him as 'Sir . 
He possessed the typical traits of his profession: slow, cocky, 
subserviant, ana ver\y armed. He radioed in our capture, location, 
names, anc addresses. The names were the most difficult thine for 



him. he cave esch letter tz 
He even hac trouble findinc 



tne dispatcn as the beginmg of a word. 
worflE for some of the letters. 



nai 
the 



to 



1 dU 

kne 



s was my worst nightmare. I was freaking out. My partner was 
try cairn about the whole thing until someone else arrived to our 
lway, his professor, the chairman on every tecnnical aspect of 

ntire univeristy as well as surrounding communities. The 
mingly fragile old man was as imposing to my partner as King Kong 
the natives. Tne professor immediatly began to interrogate him as 
n as he was witn-m sight. 1 felt as though the Daleks had 
aec. Tne professor had no regard for neither the pig nor me. I 

pleasec. our mv partner was not. The processor systematically 
nched question after Quest ion .at him. All of which he of course 
v* tne answer to. Mv partner looked down anc replied that the 
i ve w^s games. When the professor questioned him on the use of 

new accounts to get around the restricting policies of the 
tern, my partner was replying with it was to play games'. 



thou 
le ga 

-at m 
ad no 

rtlST 
j Out 
-y US 

vStem 
"t y t h l 



ng 



t he was twisted off his gord. he already has access to all 
s on the system. Besides ttiaz they all suck! w:.at was his 

1 wondered. Then the professor attackec that exact point, 
partner had access to the systems games. To this my partner 
nswer besides saying. 'I don t know. I guess... ' Then the 
o professc- - closed his interrogation with a rapid speech 
tr signing oi documents restricting usage of the system by 

wno vie j ate, the system's or another user's security on that 
II > partner stated to the idea that the signing wasn't 

he knew of ever doing. 



The professor started to leave and the officer, whom was standing at 
attention vjith me during the Nazi commander s speech, asked to the 
ettect of it he wanted us to be brought to the station. The 
professor said as simple, 'yes'. His satisfied looking knod and firm 
posture with hands behind his Pack stated he wanted much worst. The 
idea of the professor ranting a continous, "exterminate f 
exterminate", in a -Dalek voice was his -modi vat ion out luckly not his 
style. 



We were escorted through the school's nallways. Areas where, when in 
the cart:. I was lost. Stumbling around, in the oelerium of my 
aaremline high s backlash, until we nit the cold outside. The I 
calmed down some then. The pig frisked us in our heavy winter 
clothing against the security squad car. After satisfied that we did 
not have anything like a computer 1 under our jackets he put us in the 
car. The stiff hard plastic seat froze my spine and head. I felt 
tired, whicn was better than scared at the moment. 



U?e drove to the station 

lounge for tne pigs a na 

t w i n r o^ of clastic, mo ;. u 

eacn ether. The pig took 

bunch cf questions soTti 

discusion voice so 1 could hear. He 

aames story. 



whicn tu^nea out to be tne racio room anc 
mile awav. we were told to sit down in a 
ce ourselves ie.r from 

room. Asked his a 



My partner 



ry was good enougn. Better 
was called in and my 
left the room locking at me with a promising face. I sat 

indergaroen chair ne-t to the oig. he 

eo than to why I wat- 



ch airs and to 
partner into a ne= 

answered them in a normal 
e sticking to the 'hacking for 
1 failed to see tne logic in it but the professor was 
no wne^e to be seen so 1 figured the st 
than my lack of a story. After a wnile 
partner 

down in another oversized 

oaic more attention to my name and wnere 
tnere. He read oaf mv partners report and asked me to elaborate Tor 
him on some points. The points had nothing to do with the situation 
were mostly about where we cot into the campus, wh> 1 

nor student, anc i.t I had a computer at home, 
nstead of how 1 feared they would. Then he 
ha.G us sit back in the lounge anc he 
us why the ur.iversiTv' was so uptight ac". 
we would no; even bed in to understand wr.« 
cnes'i-or was .u.ist looking out to; i" 

p r o c a !j 1 y h a v e tried t o s a m o t h i 
a d v ic N i r; ten c o g ame piss 



at ail. The , 

was on the campus 

The answers came easily, 



the 

u~ now r,e wou . j. 

oecasue na i s 



k -e us his sympathy s. He told 
-jt. trie computers. He tcic us 
they coula do anc tnat 
satw. Tne pig e^en tola 
mos if was our age 



■z.-o no*-* i t 
x o this a 
an : kigr.r 



:<ught Gr. mv Goo! its o 
movie: Now we go nome 
wrong ' 



,er- These are the closing remarrs 
to oir worm pens and forget it 



minor 



that I ccjid not 



♦.her 



■y ne c.-ion off ic.er e-'planec how come : . wac 

be let go witn out a guardian present. Snit! Now here comes tne re* 

Nan, my mother' bu.re enough ne calls m> 

up. Gets r\er out ot bed and oyer to the c 

the country. 1 sweat it out and than I Goo 

her anything on the tone. 



and wakes 

which is wa : out in 

the pig did not tell 



getting a sentence 
=,s a hard core 



My mother came ana took me away with ou- the p: 

out. veah! I toroot mv mom hates tne pigs- She 

activist in coliece! My lucfc is turning, My mom did not sa> anything 

until we were near home. Then sne gave a short blurb about my numoer 

of chances and not blowing it. Cool ! I am free to live a .ife ow e y 

from computers, tor a week or so. 



Mv partner kept the whole things secret from his parents. He .just 
drove home and callec me en the tone. He had a meeting with tne Dean 
of Students and the Nazi Professor laster as soon as scnocl resumed. 
Tne put him on disciplinary suspension. Mv partner was already on 
-uspensicn for poor Grades. So ne was in deep water, almost too 



deep. Now a ve^r later he has gotten back into the program 
mysteriously and pulling a grade point average in the three area. 



Now. £• year after mv first 'Wilson , 1 intend to make 
one. How I have worred mv way back up on to a plstforn 
observation. Now its time to Give into tne pool ana s* 
forgetting to check for empty pocls though! 



3 t my las 
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im. No mor-i 
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Movie, Music, Book, 

Catalog, Cult and Zine 
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Students for Freedom is an organization dedica- 
ted to using our First Amendment rights to pro- 
mote freedom of the press and ideas. We openly 
oppose the mind control and covert #~ 
manipulation of the Conspiracy! The 
vehicle for our cause is The...Chronicle. 
Through the use of a technique known 
. ^ === » as information absorption, the 

vile effects of the Conspiracy's 

mind control can be defeated! 
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P.O. Box 80721 
Fairbanks, AK 99706 USA 




* SM 



} 9sA 



'.«£= 



UmhI 



Conspiracy 



WE 

REVIEW^ 

ZINES! 



V§ Alaska's 



only real alternative 



I 



Reviewe&in Mike Gunderloy's 

FAGTSHEET FIVE 

S3.00 from 6 Arizona Ave, 
Rensselaer, NY 12144-4502 



THE ... CHRONICLE Dec. 1988-Apr. 1989: An alternative student 
paper that s trying to provide a bit of a reality check under a variety of 
guises. The December issue was THE CONSUMER CHRONI- 
CLE, examining some of the ins and outs of greed and what it's doing 
to the planet. April was THE CONSPIRACY CHRONICLE, with 
everything from mass murderers to those politicians running things 
behind the scenes. 



THE CONTROVERSY CHRONICLE Vol. 4 #2: A very alterna- 
tive school paper from up Alaska way. This issue is filled with ail sons of 
wild and \*ooly stuff from the margins: a conspiracy at Disneyland, 
firsthand reporting from the Exxon oil spill, Nazis in your hone town. 
Majestic 12, and lots else. Some of the printing is a bit marginal, but 
overall this u great stuff- a zine that spits in the face of its ekfcrs and 
dares them io make something of it. 

THE CONSTITUTION CHRONICLE Vol. 5 #1: About the best 
student publication I see these days, one which is not afraid to jomp off 
the margins and see the underbelly of reality. This issue has UFO 
history, mysterious maps of Antarctica, a guide for the first-lisae LSD 
user, drug*ars and big business, and tattooing, to name a few tonics 
Wild Stuf£ P ' 





The Campaign Chronicle .J£l 

The Consumer Chronicle JJJ1 

The Conspiracy Chronicle J&l 

The Controversy Chronicle $1 

The Constitution Chronicle JS1 
The Commercial Chronicle.. JS1 
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of Alaska 
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TRADE 

FOR 
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ZINE! 



>From ->THE DICTATOR (#156) 
Date ->01/12/90 11:08:00 PM 

Hey (name deleted) .. .what s up? 

Ask KL to give ne a call and let me in on the details, (602-225-8581), or he 
can leave me nail on Jolnet. I'd rather him call me, instead of having that 
message pass through the Jolnet system. 

Any ways... If its in Louie again this year, Im sure I can make it... let him 
know. .thanks. 

The Dictator 

The Dark Side BBS 

+++++++++++End Example ++++++++++++++ 

The reference to "Louie" is to summercon. 

The telephone number listed above was left on a public BBS (in a different 
message) in the general message section by The Dictator in a public request 
for another user to call him. It is also the number that others have given 
us independently as one he gave them for voice contact. Hence, the number 
appears directly and unequivocally linked to The Dictator. Attempts to 
contact him through that number, however, reach a machine, and the person 
who responds to that machine has, for several months, refused to return 
calls collect or otherwise. 

Even after allegations of his apparent role in the video tapes of Summercon 
'88 surfaced, the dictator made no effort to hide his connection to The 
Dark Side. He left the following in response to several callers bickering 
among themselves over a Chicago BBS also known as "The Dark Side." He makes 
it clear the two are separate entities: 



The Dictator of The Dark Side and the above messages as also linked to the 
Secret Service informant by the nature of the logs he provided to them. We 
will continue to provide details of the substance of the documents in 
coming issues. However, messages printed in the Secret Service document 
allude to private e-mail sent to "CI 404-235," and these can be traced to 
The Dictator as the recipient by examining existing e-mail logs retained or 
acquired by others. 

The Craig Neidorf trial led to the revelation that the Secret Service had 
video-taped parts of Summercon '88 in St. Louis surrepticiously. One 
participant at Summercon who also viewed the tapes indicated that the tape 
captured the events in The Dictator's room from an adjoining room. If 
true, it indicated that advance cooperation and preparation were necessary 
between the participant-informant and the tapers. 

Why is it necessary to reveal the identity of the informant? We value 
privacy and we have no wish to embarrass those who may be coerced into 
performing unnatural acts for the government. However, if the Secret 
Service are correct, their informant was a willing volunteer who was paid 
for his services. Those who find betraying alike the innocent and guilty 
indiscriminantly for monetary gain are as ethically bankrupt as those who 
buy the service. Our abridged dictionary doesn't contain the term for those 
who get paid for performing unnatural acts, but it will come to us 
eventually. 

The informant was on a number of boards, and because he reported *FOR 
MONETARY GAIN*, we cannot be sure how many innocent people had their logs 
passed on, how these logs may have been edited or interpreted by law 
enforcement, or what uses were made of the information once acquired. The 
strangely creative interpretations and cavalier disregard of "reality" by 
federal prosecutors and some Secret Service agents are too troublesome to 
allow presumption of good-faith use. We STRONGLY URGE all persons who have 
been or currently are on a board with The Dictator to search their logs and 
consider filing a Freedom of Information Act request (see concluding file). 



n 



— Begin Phoenix Project Message \ 2 

> 

>13/100: the dark side 

>Name: The Dictator #115 

>Date: 10:42 pm Fri Nov 04, 1988 

> 

>attention: 

> the dark side bbs is up and running. . .any user that wishes to become 
>a part of history. . .please call.. this is yet another hard working system 
>that wishes to make its mark in computer history. 

> 

> give us a call. . 
> 

> the dictator 
> 

>dark side bbs 602-789-9864 

> 

> summer con '88 members given iroddiate access 

The number given is different from the one later identified in SS 
documents as the sting board number. Perhaps it was typo, or perhaps 
it was and it was presumably changed shortly after this message was 
left. An anonymous sysop of a board in the Midwest told CuD that the 
Dictator personally left the number of The Dark Side on the BBS, and 
recalls at least one public message in which The Dictator left a 
public message requesting people call it. This BBS in question was a 
quasi-open board in that — as most boards, including public ones — after 
a preliminary log-in, virtually everybody who seemed "non-loony" was 
validated. The point is that The Dictator was ACTIVELY SOLICITING 
CALLERS OPENLY, and not simply inviting a "select few" to call the 
board who "demonstrated an interest in conducting criminal 
activities." One user who documents participation on The Dark Side 
from shortly after it's inception states that The Dictator encouraged 
him to tell his friends to call The Dark Side and, at one time shortly 
after it "went up after being down" actually "seemed desperate for new 
users . " 

According to information from several DARK SIDE users and logs they have 
provided from The Dictator on his own system and on others, The Dictator 
took an active role in generating message topics. According to one source, 
The Dictator would rarely provide information, but would attempt to generate 
seemingly innocent topics that might, in retrospect, provide the kind of 
"documentary evidence" (especially if take out of context) that could lead 
to suspicion or to searches. The following were provided as examples of 
"typical" ways that a discussion topic might be generated. We observed 
from the responses to these notes (that we deleted), that the innocent 
question would elicit a technical or potentially incriminating answer of 
the type used prejudicially in the sentencing memorandum of the Atlanta 
Three, or of the type used to justify the raid on Steve Jackson Games. The 
lesson we take from the following is that the Secret Service, through the 
use of an informant, seems to have *ELICITED* statements that could be used 
as evidence. 

Drawing from the above information, the following suggests that The Dark 
Side, The Dictator, and a person identifying as (name deleted) are the sting 
board, the sysop, and the informant, respectively. 

1. We have obtained telephone billings and computer telephone logs for 
December, 1988 and through mid-1989 indicating that when one called (602) 
789-9269, The Dark Side BBS was accessed. This suggests that the sting number 
and The Dark Side were one and the Same. 

2. A person identifying himself as "The Dictator" called a number 
of boards in 1988-1990 (among them The Central Office, The 
Phoenix Project, Hackers' Den, Ripco, and others) and through 1990 
continued to call such boards as Atlantis, Ripco, Face-to-Face , 
BlitzKrieg, and others. In public and private messages on these 
boards, The Dictator would typically include in his signature 
both his name and his association with The Dark Side BBS: 



** WHAT'S THE POINT? ** 
******************************************************** 

When the federal government uses *paid* informants, nobody wins. 
Officially sanctioned deception and betrayal, as Gary Marx argued in his 
book "Undercover: Police Surveillance in America, w is generally far more 
detrimental to public order in the long run than whatever "crimes'* the 
deception targets. 

When federal agencies set up sting boards and use informants to gather, 
even generate, diverse information that is in turn given to agents as 
potential "evidence" of wrong doing, there can be problems. In the 1960s 
and 1970s, we have seen through various class action suits, congressional 
hearings, FOIA requests, and other inquiries, how abuse of information by 
those who collected it resulted in lost employment opportunities and other 
uncool consequences. In the past year, we have also seen the misuse of 
information in indictments, sentencing memorandums, and especially in 
several search affidavits and seizure warrants. 

Most of us are concerned if agencies collect information on us against our 
knowledge, because the potential for harm can be subtle. Many readers of 
CuD have called a variety of bulletin boards considerated to be 
"underground." When an agency such as the Secret Service sets up a STING 
board and PAYS an informant to capture logs, those of us who call these 
boards have reason to be concerned with how our ** LEGAL, LEGITIMATE** posts 
may be interpreted and used by agents. When we recall that one sysop was 
liked to a fraud conspiracy because of a two line comment that kermit is a 
7-bit protocol used primarily on mainframes, our confidence in agents' 
interpretive competence diminishes. 

Our intent has not been to embarrass The Dictator. If it were, we would 
include the name he uses when socializing with others. 

IT WOULD ALSO BE TOTALLY REPREHENSIBLE IF OTHERS WERE TO ENGAGE IN 
HARASSMENT OR OTHER RESPONSE AGAINST HIM! The CU has increasingly been 
united by principles of justice, and to engage in unjust acts because we 
feel others have done the same to us violates those principles we are 
working toward. 

Calls to the "voice number" The Dictator has left on at least one public 
post on a public board, and given to others, have gone not received a 
response. Messages left to him on BBSs have also not generated contact. We 
continue to invite him to contact us and give his side of the story. There 
are generally shades of grey in even the darkest images, and if he contacts 
us we promise either a fair and impartial story, or, he can write his own 
version and we will publish it unedited. 

We also remind readers that the issue IS NOT an individual. At stake in 
all this is the issue of privacy and police power as we enter the 21st 
century. When laws cannot keep up with technology, the consequences may be 
ill-considered strategies for monitoring and punishing alleged wrong-doers. 
As Gary Marx reminds us in his book "Undercover" (p. 233): 

In a democratic society, covert police tactics, along 
with many of the other surveillance techniques, offer us a 
queasy ethical and moral paradox. The choice between anarchy 
and repression is not a happy one, wherever the balance is 
struck. We are caught on the horns of a moral dilemma. In 

Machiavelli's words: (Never) let any state ever believe that 
it can always adopt safe policies. . .we never try to escape 
one difficulty without running into another; but prudence 
consists in knowing how to recognize the nature of the 
difficulties and how to choose the least bad as good." 
Sometimes undercover tactics will be the least bad. Used 
with great care, they may be a necessary evil. The 
challenge is to prevent them from becoming an intolerable 
one. 
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+ + 

A. T. M. Fraud Made Easy 

summary and research by 
Count Zero 

(A CHiNA Info-Net Prod) 

+ + 

Have you ever looked longingly upon the sight of your local PULSE machine 
and thought, "There must be some way that I can make some money REAL easy 
here."? 

Well, there is. But it won't be easy. Protection methods can be overcome, 
but the technology involved must be understood IN ITS ENTIRETY before an 
attempt at illegal access is to be made. There are hundreds of people, 
guests of the state, that figured their plans infallible, only to fall 
victim to a well-hidden camera. 

This article will not be a lesson on HOW to break into the machine, it is 
merely a summary of the operations involved with a normal ATM transaction. 
This information is being presented on a "for information's sake"-only 
basis. I, Count Zero, do not promote nor remotely condone any illegal 
acts of any sort. So there. 



I. MAGNETIC STRIP FORMAT 

This would seem to be the most efficient method of trying to access illegal 
sums of cash. You could: 

a. steal somebody's card and PIN code 

b. synthesize a card 

c. attempt to "jackpot" the system 

We will only look at option B. As "A" is up to your own devices and "C" has 
several good text files written about it already. So "B" it is. 



Let's look at the format of the data written to the magnetic strips, 
has been taken from a recent HARTWELL, INC manual. 



This 



[ XX XX XX XX XX XX XX XX ] [ YYYY ] [ - 20 CHARS - ] [ ZZ ZZ ZZ ] [ CC CC ] 

Your individual acct. PIN Name of card Bank route CHKSUM 
number/serial code Code issuee code/rem. 

access # 

For validation, each entry is written twice but not written here for 
ease of typing. But it is repeated in the form of: 
"ACCT NUM" "ACCT NUM" "PIN CODE" "PIN CODE" etc... 

These codes may be examined by building a simple code-reader as many 
have done which can be easily interfaced to your IBM-PC. Full plans 
to be put into a future CHiNA newsletter. 

If you were to attempt to write a magnetic strip or change a currently 
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existing one, you would need to be using a head-write circuit based on 
the popular Motorola BCX119221-A. . .C series of head control chips. 

NOTE: Make sure to change the last 2 values! They constitute the 
checksum of the entry. 

Merely add all existing characters written (only the first entry, not both 
of them) using the following chart: 



CHARACTER 



VALUE 



0..9 
A..Z 

EOL 

EOT 

CLR 

HMX 

PTT 

RIA-1 

RIA-2 



0..9 

10. .36 

37 

38 

39 

40 

41 

42 

43 



I doubt anyone in the communications biz needs an explanation of these terms 
so I'll move on. 



II. ATM HARDWARE 
Usually consists of: 



\ \ 

I A | 
\ \ 




A. Camera Mount 

B. Hidden Voice-Activated recorder & printout link 

C. Display Monitor 

D. Options buttons 

E. Card Slot 

F. Receipt Slot 



Your machine may vary slightly. 
Simple rules for each. 



But the concept will almost always hold true. 



A. Wear a paper bag or mask. See also Part II A 

B. Do NOT speak. This is the most crucial part! See also Part II A 

C. Nothing 

D. Wear gloves 

E. See Part I 

F. TAKE YOUR RECEIPT AND BURN IT!! 
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One of t^he neat flaws in many machines made prior to 1989 involved the 
use of the "CANCEL" button. This button was made to be pressed when the 
user decided, at any time during the transaction, that he didn't wish 
to continue. The display would jump immediately to: 

"TRANSACTION CANCELLED - CHOOSE ANOTHER?" 

This was all well and good, but the machines did not disable this feature 
between the time your cash was dispensed and you were prompted for your 
next activity. In effect, you could push the "CANCEL" button after your 
money has been withdrawn and it would not be added to your account record! 



THIS STILL WORKS IN MANY PLACES! 
STILL HAVE NOT BEEN UPGRADED. 



OVER 85% OF ALL MACHINES MADE BEFORE MAR. 198! 



Although most machines of that period would only work if you were withdrawing 
amounts larger than $20 (usually $25 is the next possible choice!) 
This is ideal if you are using another's card! 

II A. CAMERA/SOUND HARDWARE 

You can go other routes when dealing with camera systems. You do not have 
to wear a bag on your head (unless the cosmetic improvement is quite large) 
Thin alloy metal such as common aluminum/tin foil, which are full of impurities 
react in a bizarre way when photographed through the special lenses that are 
commonly used. The effect is to "blur" or "bleed" the image, rendering it 
indestinguishable from an accident in your local Sherwin-Williams store. 
Most people prefer to make a "headband" of this metal, lined with copper 
wire in a sine wave pattern when accosting a machine. You should 
seriously consider this possibility! 
For further reading on this subject, consult: 

BANKER'S WORLD - Apr 1989 

"Where Have All the Dollars Gone?" 
pp 24-29 

P. I. - Apr 1989 

"The Last Straw" 

pp 37-41 (p 38 in particular has a nice 
diagram. Fig 1) 

Sounds, these articles also suggest an indirect method of dealing with the 
voice-activated recording device. Oddly, a pure square wave tone (roughly 
around 3100 hz) will cause a major screwup in the sound-sensing abilities 
of the recorder. It usually will have to be replaced. Suggested volume, 
given at 6" range is 8.5+ db. Obviously, anything louder will do. 

An interesting side-note is that this has become a past-time of suburban 
teenagers ! 



Well, hope this gets you started! 
exciting file! 



More will be coming in the next 
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